CVE-2026-90862 Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

Improper authentication in the Web Transfer Module of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

EUVD-2026-113016

Improper authentication in Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials...

CVE-2026-84295

Progress Software WS_FTP Server on Windows is vulnerable to an improper authentication flaw in versions prior to 2024.0.6 and 2025.0.3 . This vulnerability allows an unauthenticated remote attacker to access sensitive information , specifically including administrative credentials . No specific t...

CVE-2026-84295 Improper Authentication in Progress WS_FTP Server

Improper authentication in Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials...

CVE-2026-112256

OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 are vulnerable to a logon bypass due to the acceptance of extraneous untrusted data with trusted data (specifically, an attacker-controlled completed-methods list ). Thi...

EUVD-2026-113003

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and...

EUVD-2026-113002

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for...

CVE-2026-112255

OpenText Advanced Authentication Server is vulnerable to an insecure default configuration issue (CWE-1188) affecting versions 6.4.0.0 through 6.4.3.x , 6.5.0.0 through 6.5.0.x , and 6.6.0.0 through 6.6.1.0 . The root cause is an insecure default allow-list that permits Excessive Allocation of re...

CVE-2026-42167

CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

EUVD-2026-113155

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication...

CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication...

CVE-2026-93680

Langflow OSS versions 1.0.0 through 1.12.8 are vulnerable to an authentication bypass (CWE-287) that allows a remote attacker to bypass security restrictions. Specifically, versions 1.5.0 through 1.11.4 allow unauthenticated connections to the MCP SSE endpoint , enabling attackers to initialize M...

CVE-2026-115708

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

EUVD-2026-113127

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication...

CVE-2026-110245

Langflow OSS versions 1.0.0 through 1.12.4 are vulnerable to improper authentication (CWE-287 ). This flaw could allow a remote attacker to obtain sensitive information. To remediate this vulnerability, IBM strongly recommends upgrading to version 1.12.5 . For users on affected versions, it is ad...

nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification

A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1, tls.checkServerIdentity may fail to classify the host as an IP address, normalize it to a canonical form, and match...

Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-109952

A flaw was found in FreeRDP. A remote attacker, acting as a malicious server or an on-path attacker, can exploit this flaw to cause information disclosure by intercepting user credentials in cleartext. Due to missing validation during connection negotiation, the client accepts unapproved security...

EUVD-2026-112921

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...